Questions tagged [one-time-password]
One-time password (OTP) protocols and implementations (software and hardware)
257
questions
0
votes
1
answer
45
views
How to avoid non-in-person "handshakes" and spoofing due to compromised URL data on NFC card
I am designing a system that allows users to purchase my NFC cards and sign up for an account on my online SaaS website.
The System
For the sake of explanation, assume the website is hosted at domain ...
- 1
2
votes
2
answers
385
views
Web Application Using Identity Federation & OTP
We are running a web application using a client's identity federation to authenticate users. A new requirement is to use 2FA, we have decided to use an OTP algorithm using Java, similar to this one ...
CommunityBot
- 1
0
votes
2
answers
88
views
Alternatives for password where at least one secret is not know by the server, with similar transparency
Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
- 48.4k
5
votes
2
answers
2k
views
How should I share a TOTP shared key with my users?
I want to add one-time passwords as gates for certain important actions in the application I am working on. It is not two-factor authentication, although it may be extended to that use case later.
...
- 2,629
0
votes
0
answers
60
views
One time password as passwordless authentication [duplicate]
When logging in to azure the login process emails me a short one time code to use and doesn't require a password. I am assuming it is a well trusted process in order to be used on such critical ...
- 129k
30
votes
2
answers
5k
views
What is the point of entering numbers in the two-factor authentication app?
Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator:
This is ...
- 30.6k
0
votes
0
answers
72
views
Can Sending All Possible Otp Codes Within 1 Second Bypass Server Protections? [duplicate]
I'm exploring the security implications of OTP (One-Time Password) authentication and wondering about the effectiveness of server-side protections against brute force attacks.
If an attacker attempts ...
- 129k
9
votes
1
answer
3k
views
Can displaying date and time on screen upon TOTP login failure makes system more vulnerable?
We are using TOTP(https://datatracker.ietf.org/doc/html/rfc6238) for a web application to enhance the security. TOTP works on UTC. if system clock drifts OR NTP is not synced, TOTP generated by ...
- 16.1k
0
votes
1
answer
93
views
Are Apple TOTP verification codes the HOTP secret?
Apple provided the capability of using TOTP within iOS itself and I noticed there was a section for Use a verification code on a website or in an app which bypasses the QR Code.
My question is whether ...
- 9,434
1
vote
3
answers
217
views
Creating Password from 2 different part
I’m looking for Term Or Some platform for managing Password Authentication with this way :
Password construct from 2 Part ,
First one is static and you can make it and second Part Generate From TOTP ...
CommunityBot
- 1
16
votes
4
answers
6k
views
Why are one time password reset links safer than one time passwords?
Recently I applied for a job at a company creating
security-critical solutions for military, aerospace, ...
After registering at their webpage, I received an email with my username and a ...
- 183
0
votes
0
answers
305
views
Is it possible that Telegram's OTP has been hacked?
A couple of my friends have been in a kind of pickle recently. There have been attempts to hack their Telegram accounts and hackers somehow learned their one time pass codes but the login attempts ...
- 129k
0
votes
2
answers
483
views
Is reading off a OTP code over the phone standard practice?
I just called a number that I thought was my bank's and reached a customer service representative that asked me to verbally read to them a one-time passcode that was texted to my phone.
Is this ...
CommunityBot
- 1
6
votes
1
answer
2k
views
How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?
My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
CommunityBot
- 1
3
votes
3
answers
1k
views
Password reset link vs Temporary password
Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.
Any ...
- 129k
0
votes
1
answer
411
views
Should i verify otp after login or before?
I am building a token-based authentication API, and I have three main methods:
Register Method: It takes credentials (email, password, phone number) and creates the user, then sends an OTP message to ...
- 395
2
votes
2
answers
27k
views
Why my mobile sends SMS to a random number without my permission?
My mobile sends SMS to random numbers without my permission. All messages are sent automatically. Here is an example of an SMS.
SBIUPI qUrXgeX26iEY%2B2si9JHhubIjm7R2aHoo6pWcbXBpJho%3D
All the ...
1
vote
1
answer
135
views
Is using the computer for MFA safe?
Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer.
But what are ...
- 201k
26
votes
4
answers
11k
views
Is it secure to store a two factor authentication seed in a password manager?
I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service.
If ...
- 119
1
vote
1
answer
153
views
One Time Password Mobile phone authentication
Can the Mobile phone One Time Password authentication be alphanumeric with special characters?
If Yes, There will be more pros and less cons with increased security?
One Time password
Can a One Time ...
0
votes
0
answers
16
views
How to limit user from making too many request on an API endpoint? [duplicate]
I have a form where the user can add his phone number then, he receives a verification code on his phone number to log in/register.
Now a user could make too many requests with generated valid numbers ...
- 101
3
votes
1
answer
705
views
Does Push 2FA protect against phishing/MitM better than TOTP?
I was having the debate of TOTP vs Push Notifications and found this claim online:
Is the 2FA method protected against phishing?
Chart Explanation: The most common method of phishing is persuading a
...
- 105
5
votes
1
answer
675
views
Adding salt to TOTP
I'm building an high velocity auth system, used both for user to machine and machine to machine authentication and authorization. To prevent a replay attack I'm adding a nonce to each request, but in ...
- 1,231
9
votes
4
answers
1k
views
Is a "magic link" a kind of authentication?
From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system.
Can this ...
0
votes
1
answer
91
views
Does this implementation of 2FA expose valid credentials?
I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
- 129k
1
vote
2
answers
2k
views
one-time link on 1ty.me
1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is ...
- 1
0
votes
2
answers
271
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
2
votes
1
answer
511
views
Multiple login attempts made using mobile OTP in multiple customer sites at the same time
We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes ...
CommunityBot
- 1
1
vote
1
answer
215
views
What’s the best way to only allow a file to be opened with multiple people’s authorisation?
Is there software available that makes it easy for multiple authorisations to be required before a file can be opened? The simplest solution I've found online is to encrypt a file with a password, ...
CommunityBot
- 1
1
vote
0
answers
281
views
Does having authenticator app/OTP generator built into Password Manager defeat its purpose?
For example the KeepassOTP plugin is one of a few plugins for Keepass, that allows users to view their OTP code from within the password manager itself. Does this defeat the purpose of having a OTP as ...
- 65.6k
1
vote
3
answers
835
views
Best practice for authenticating resend email requests
I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database.
In my service, upon signing up/resetting a password, the user will be redirected to ...
- 1
0
votes
1
answer
1k
views
Offline One Time Password algorithm
Sometimes when we login in some services we should enter One Time Password or OTP that can be received via SMS, e-mail or a voice call.
Among these options, there are some mobile apps that can ...
- 9,434
0
votes
0
answers
179
views
Can OTPs substitute password? [duplicate]
One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
- 129k
0
votes
0
answers
316
views
Why we need complicate truncation for the OTP?
If we assume that Time based OTP generates the OTP using the hash function like SHA-3. Then, the generated OTP would Hash(Secret, Shared time).
We want a shortened string rather than a full hash ...
28
votes
6
answers
20k
views
Best practices for storing 2FA recovery codes
I’ve recently started using 2FA on a bunch of services and I’m not sure how to best store the recovery codes. I can think of 3 options:
In a secure note on LastPass
In a Dropbox folder
On a usb stick
...
2
votes
2
answers
568
views
Are there still ways that OTP is safer than FIDO?
From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
CommunityBot
- 1
2
votes
1
answer
490
views
Is OTP an acceptable alternative to a password in single-factor authentication?
I recently discovered that when I have two-step verification disabled on my Amazon account, Amazon will allow me to sign in to my account using only my phone number and an OTP code sent via SMS. I am ...
- 19k
20
votes
3
answers
18k
views
How to store OTP seed securely at the validating server
'Everyone' knows when storing passwords in a database this should be done securely for example by using salts and an appropriate hashing algorithm.
Most OTP (One Time Password) solutions are based on ...
- 99.6k
27
votes
1
answer
17k
views
What are the differences between the U2F and UAF FIDO authentication standards?
Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
- 101
2
votes
1
answer
342
views
Is password-append OTP bad practice?
I recently encountered software that requires me to put my password followed by a TOTP token into a single entry field. (Similar as to what is depicted in this question).
While it can be debated ...
- 10.9k
0
votes
1
answer
190
views
SOTP - Signed One Time Password
I was thinking of a OTP algorithm that signs a randomly generated password.
There are two things at play here:
The MFA portal
Knows the public key of the user's MFA app
The user's MFA app
Has a ...
- 2,057
0
votes
1
answer
223
views
Is it more secure to receive OTP or send OTP?
I am working on a project that requires users to set up 2-Factor Authentication. As an additional option (apart from the Authenticator app), users can choose their WhatsApp number as an authentication ...
CommunityBot
- 1
0
votes
0
answers
166
views
Is passwordless OTP based authentication SOC2 compliant?
I have a client requirement to implement login without password. During sign in an otp will be sent to the user's email address and the user can use it to login. This will have an expiry.
No password ...
- 1,462
7
votes
3
answers
4k
views
Storing Seed for TOTP
We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
1
vote
3
answers
760
views
Is an OTP alone useful for a hacker?
Further, does an unused OTP expire by itself? i.e in regards to digital banking - in case a hacker accesses your SMS's through malware or other means.
CommunityBot
- 1
1
vote
0
answers
104
views
Is it necessary to have keep these 4 accounts separate from password manager?
Microsoft Authenticator requires an:
Outlook account
Verification account
iCloud account
The first two are required to set up the authenticator on a new device, the latter stores all the data to be ...
- 129k
0
votes
0
answers
161
views
What is GitHub authentication SDT ? And why is it sending OTP from a residential number? [duplicate]
I had enabled 2FA for GitHub using a mobile number. Today when I tried to log in from a different device, during the 2FA verification time, I received the code from a consumer phone number [ +91 ...
- 129k
0
votes
2
answers
844
views
How can I use a user's own SMS service to send OTP and make mobile number verification in my Android app?
Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile ...
- 48.4k
12
votes
5
answers
10k
views
Is there any alternative beside sending One-Time-Password via SMS?
I'm working on one smaller system where it will be required to enter One-Time-Password (OTP, not to be confused with a One-Time-Pad) to download sensitive files which will be delivered to the user.
...
- 129k
3
votes
4
answers
1k
views
How do hardware OTPs work?
I've recently stumbled across a number of one-time-password (OTP) smartcards in some of the internet shops specialized on cryptographic equipment.
Now I know / think to know how OTP works with ...
- 129k